3 ms·

Because the CA needs to do a lot of checks that cannot be automated (mostly over the phone). And they also need to maintain business relationships with every si

by LeonM 3y ago

Because the CA needs to do a lot of checks that cannot be automated (mostly over the phone). And they also need to maintain business relationships with every single trademark office to verify your mark (logo). Honestly I am amazed that they can even do this for the price they ask. It will have cost the CA a lot to get this certified, and judging from the number of BIMI VMCs we see in the wild, I'd doubt that they are making money.

pnpnp 3y ago
This seems like the original argument for SSL, which ended up hurting smaller providers. You should already be able to verify that the mail is from the registered domain and provide a checkmark with freely available tools.
- Symbiote 3y ago
  The verification is that the mark is a registered trade mark of the company owning the domain.
  - rixthefox 3y ago
    That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone. This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required. Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image. I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.

by LeonM 3y ago

pnpnp 3y ago

This seems like the original argument for SSL, which ended up hurting smaller providers. You should already be able to verify that the mail is from the registered domain and provide a checkmark with freely available tools.

Symbiote 3y ago
The verification is that the mark is a registered trade mark of the company owning the domain.
- rixthefox 3y ago
  That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone. This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required. Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image. I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.